Welcome to Splunk Answers, a Q&A forum for users to find answers to questions about deploying, managing, and using Splunk products. Contributors of all backgrounds and levels of expertise come here to find solutions to their issues, and to help other users in the Splunk community with their own questions.

This quick tutorial will help you get started with key features to help you find the answers you need. You will receive 10 karma points upon successful completion!

Timeline App duration problem

0

Hi everyone!

I'm trying to use Timeline module but I have some trouble with the duration:Note: I'm working with a lookup file

So, I have start and end contract date for some object, and obviously, I would like to see on a timeline when a contract start and end.I do the following:convert timeformat=%Y-%m-%d mktime(timeDate) mktime(endDate) | eval diff=(endDate-timeDate) |table timeDate, "Contract #", diffI have a timeline but, for example: I have a contract starting at 2009-10-01 and ending at 2014-10-31. The diff value in seconds is correct but, on the timeline it represent only 1day. I don't understand where the problem is. (By the way, every starting date is correctly put on the timeline

1 Answer

In fact, a collegue help me and find that we have to do the following: eval diff=(endDate-timeDate) * 1000With this multiplication the results are well design. But he doesn't know why we have to do this. If anyone has an idea, the answer will be welcome!

We use our own and third-party cookies to provide you with a great online experience. We also use these cookies to improve our products and services, support our marketing campaigns, and advertise to you on our website and other websites. Some cookies may continue to collect information after you have left our website. Learn more (including how to update your settings) here. Closing this box indicates that you accept our Cookie Policy.